Privacy & Cookies

PRIVACY NOTICE & COOKIES

Like everywhere you shop online, Boden collects your personal information. Think of it as our way of getting to know you better. It means your orders are processed lightning-fast and we can send offers tailored to you, for things that you’ll actually want (that spotted raincoat, for example). And if there’s a problem with your order (unlikely, but it does happen), it also means we can deal with it super-speedily.

Since we have your details, it only seems fair for you to have ours. JP Boden & Co. Ltd is a company incorporated in England and our company number is 2692601. We are the data controller registered with the Information Commissioner’s Office (ICO). When it comes to the information we have squirrelled away about you, we want to be totally upfront – honesty’s the best policy, after all. You can rest totally assured that we’re committed to protecting your privacy and the security of your personal information.

Still got a burning question? Feel free to contact us using any of the methods listed in our Contact Us section.

What data we collect, why and how we use your data

A penchant for sparkly flats, an addiction to polka dots… what you order speaks volumes and this helps us learn what you like. Sometimes we use data from other companies that you’ve shopped with to tell us more. We like to get the full picture, you see: that way, our marketing is right up your street

We may collect the following data about you, and we’ve explained the lawful basis (in brackets) and purpose for doing so in each case:

• In order to process the orders that you place, send you email confirmations of your order, send those packages of style direct to your door, verify your payment details, or to process returns and refunds, we may use your name, address, email address and payment card information. We ask for your mobile number so that we can call or text you about your orders, but it’s optional anyway. It’s handy when the courier can’t find your address, for example, or if there is a problem with your order (contractual performance).

• We like to keep you in the Boden loop so from time to time we’ll send you catalogues, special offers and promotions by post, email or SMS messages (legitimate interests/ consent) using your name, address, email address, and / or mobile number.

• We also use your name, address, email address and payment card information for fraud prevention purposes, to verify you are really a customer shopping for appliqué T-shirts, rather than someone up to no good (legitimate interests).

• We use your name, address, email address and telephone number in order to respond to your queries and occasional complaints (nobody’s perfect) (contractual performance; legitimate interests). We may also keep a record of these to inform any future communication with us, to demonstrate how we communicated with you throughout, to ensure that we provide you with the best possible service.

• We may use your email address, postcode and date of birth to send you survey and feedback requests to help improve our services. It helps make our products or services more relevant to you (legitimate interests).

• Sometimes, we may need these to use your name, email address and / or address to send you communications that are required by law or necessary to inform you about our changes to the services we provide you (legal obligations; contractual performance).

• When you leave a product review for us on our website (thank you), you’re given the option to provide your email address which we use to verify your review. If you provide your email address, you will be entered in to a prize draw – we use your email address to administer the draw (legitimate interests).

• If you participate in our research activities (for example, customer research surveys, customer WhatsApp groups, Customer focus groups, Boden Insiders), we’ll use your name, email address and sometimes mobile number in order to administer the group, and your photographs to improve the products and services that we provide to our customers (consent). We’ll always let you know when we’re going to ask you for photographs and explain how they might be used.

• In order to improve the products and services that we provide, we may use your personal data to invite you to participate in market research (legitimate interests).

• If you’ve asked us to give your clothes a refresh through our ‘Care, Repair, Re-wear’ service, we’ll use your contact details (name, address, email address and phone number) to get in touch with you about your garments (consent).

• If you’ve volunteered to participate in ‘Pass it On’ recycling scheme (so that your well-worn clothes can inspire other peoples’ lives), we’ll use your name, address, email address and phone number to administer the scheme (and to make sure that you get the account credit that we’ve promised, in order to say a big thank you) (legitimate interests).

• We like to know your date of birth – spoiler alert, but it means we might wish you a Happy Boden Birthday (legitimate interests). It’s entirely up to you whether you tell us your date of birth, though.

• We always need to confirm that you’re over 18 so that we can legally enter into a contract with you (legal obligation).

• We may use your date of birth data for fraud prevention and detection, and research purposes (legitimate interests).

• We keep records of the live chats, telephone calls, emails and postal correspondence from you so we can provide you with the great customer service and support we’re known for (contractual performance). We may also use this data when training our staff, to make sure we continuously improve that customer service (we set our goal at ‘incredible’) (legitimate interests).

• We use information about your device and how you use our website (including your IP address, device type) to continuously improve our website, to set default options for you, and to show you the correct content (for example language and currency). We may also use it to develop, test and improve the systems, services and products we provide to you by say, recording your browser’s Session ID to help us understand more when you leave us online feedback about any problems you’re having. This data is also used to prevent and detect fraud. We collect your IP address to learn more about how you use our website. IP address data allows us to analyse site usage and visitor numbers and see how our advertising performs (so we can understand what you like). We also use this information to improve our website, which makes our marketing more relevant to give you the best experience we can (legitimate interests).

• When you participate in a survey, competition or promotion, we use your data to run the activity. If we don’t use this data, you can’t win competitions or use promotions. Imagine. We may also use this data in order to fulfil your prize if you’re a winner (legitimate interests/ consent).

• If you work with us as an influencer, we may collect your name, email address, address, images of you (and, if you work with Boden through paid partnerships and your children are included in your images, we’ll collect their images too), and clothing size. We use your name and email address to engage with you and to administer events. We may use your address to send presents to you, and we may post your images on our own social media pages and Boden websites (contractual performance).

• If you upload your photographs to BodenByMe (please keep them coming), these may be published on our website along with your name (consent).

• Did we get your best side? To protect our customers, premises, assets and partners from crime, we operate CCTV systems in our stores and car parks that record images for security and crime prevention (legitimate interests).

• If you interact with us on social media, we use this your social media username or identifier to help us respond to your comments, questions or feedback (legitimate interests).

• There may be situations where we are legally required to share your personal data, for example, when a court order is submitted to share it with law enforcement agencies or a court of law (legal obligation).

• Every now and then, we love to surprise and delight our customers by sending unexpected presents or treats. We may use your name, address or email address to do this (legitimate interests).

• If you are hosting a Ukrainian family and you have applied for Mini Boden clothing, we will use your email address to process this request. We will also need your full name and address in order to send the items to your home. In addition, you may have been asked to provide a Global Web Form (GWF) number and a copy of the parent’s flight ticket, as provided to you by the Home Office. You will have been asked to provide confirmation that you have obtained consent from the person named on the flight ticket to provide their ticket and GWF number to Boden. We will use this information to verify that your application is valid and will delete all copies of the GWF number and ticket within one month of having received these (legitimate interests).

• If you place an order on behalf of another person (for example, if you buy a gift for another person and provide their name and address for delivery), please ensure you have obtained their permission before agreeing for them to receive marketing from Boden during checkout.

• If you don’t want to give us your data, you don’t have to. However, if you don’t, you may not be able to buy products from our website and catalogue, and you are unlikely to receive our best customer service. It’s your call.

• You may elect to receive text messages from us. When you sign up to receive text messages, we will send you information about promotional offers and more. These messages may use information automatically collected based on your actions while on our sites and may prompt messaging such as cart abandon messages. To the extent you voluntarily opt to have Text notifications sent directly to your mobile phone, we receive and store the information you provide, including your telephone number or when you read a text message. You may opt out of receiving text messages at any time by texting “STOP” to our text messages. For more information about text messages, see our Terms and Conditions.

• If you’ve signed up to receive text messages from us either via our website or by sending a text message indicating your consent, you are providing your prior express written consent to receive recurring marketing or promotional Text messages from us. We will send you information about promotional offers and more. These messages may use information automatically collected based on your actions while on our sites and may prompt messaging such as cart abandon messages. To the extent you voluntarily opt to have Text notifications sent directly to your mobile phone, we receive and store the information you provide, including your telephone number or when you read a text message (consent).

Interactions with Boden website:

• To enhance your experience with Boden, we use cookies, web beacons, pixel tags to automatically collect information about your interaction with our websites. This allows us to use your personal information in several ways. Firstly, we analyse your preferences to tailor products that are more relevant to you. Additionally, we deliver personalised content, advertisements, and communications based on your interests, provided you've opted in to receive marketing communications. This process is essential for us to improve our offerings and personalise your customer journey, relying on our legitimate interest.

• Moreover, if you accept cookies on your initial visit and continue navigating our website, we may use the collected personal information to provide you with a customised browsing experience. This includes remembering your past activities, such as viewed pages or products, and your preferences. We also use this data to deliver interest-based advertising on third-party websites, aiming to make our online offers more compelling for you.

• For instance, through the Facebook (Meta) pixel integrated into our websites, Facebook identifies users who have visited our site, forming a 'Custom Audience.' This enables us to display Boden ads to Facebook users who have shown an interest in our offerings or share similarities with our existing customers. We are able to do this based on our legitimate interest and Facebook's handling of personal data which is governed by its Data Usage Policy, which you can review at https://www.facebook.com/about/privacy. Should you wish to opt out of Facebook's "Custom Audiences" remarketing feature while logged into Facebook, you can do so at any time through https://www.facebook.com/settings/?tab=ads#_=_.

Data that we receive

We may receive personal data from the following categories of third parties:

• We may have received personal data from third parties including data brokers such as Epsilon and Experian where they have received the individual’s name from another company that has indicated they wouldn’t mind receiving catalogues from us. If this applies to you, you can contact us using any of the methods listed in our Contact Us section at any time and ask us to remove you from our mailing list. We’ll be happy to oblige. Alternatively, if you’d like to opt-out directly from these companies, you can do so using the following methods:

■ Epsilon

Visit https://abacus.epsilon.com/services-privacy-policy/
Email nomail@epsilon.com
Phone 020 8943 8049

■ Experian

Visit www.experian.co.uk/cip
Email customerservices@uk.experian.com
Phone 0115 828 6738

• When you enter a competition hosted by another company and indicate that you wouldn’t mind hearing from Boden, for example by entering a competition hosted by another company (such as World Kindness Day by Grazia) or signing up to marketing from Boden through CWPG, these third-party companies may share your personal information with us, in accordance with your preferences. If this applies to you, please contact the third party that you provided your consent to, or Boden using the information listed in our Contact Us section.

• We may receive information from market research companies to help improve your experience with us.

• We may receive data from market research companies who help us to identify individuals that may be interested in taking part in our customer insight surveys and activities. In these cases, you would have expressed your preferences to the market research company.

• If you work with us as an influencer, we may have received your information from an influencer agency.

• We may also receive data from third parties such as fraud detection agencies when we transact with you, so we can verify that you are actually you, not some (boring-clothes-loving) imposter.

• If you are from the Ukraine and being hosted by a Boden customer in the UK, your UK host may have applied for Mini Boden clothing. During the application process, your host may have been asked to provide a Global Web Form (GWF) number and a copy of the parent’s passport, as provided to the host by the Home Office. The host will have been asked to provide confirmation that they have obtained consent from the person named on the flight ticket to provide their ticket and GWF number to Boden. Boden will delete the GWF number and ticket within one month of having received these.

• We may have obtained your information, such as name, address, email address and telephone number, if another person has placed an order under your name (for example, ordering a gift to be delivered to you).

Sharing your data with others

There are circumstances where we may share some of your data with others:

• Delivery Companies / Couriers (contractual performance) - … so that your shiny new purchases can be delivered to you and so that you can return any items you’re not completely in love with. After your purchases have been delivered, the delivery company / courier may contact you by email you to check that you are happy with the service that you have received from them. You can read more information about these delivery companies / couriers and how they use your data by following these links:

• Clicklink - https://www.clippergroup.co.uk/privacy-and-cookie-policy/

• DPD - https://www.dpd.co.uk/privacy_policy.jsp

• Evri - https://www.evri.com/privacy-policy

• Royal Mail - https://www.royalmailgroup.com/en/site/privacy-notice/

• Asdatoyou - https://www.toyou.co.uk/privacy-policy

• In Post - https://inpost.co.uk/privacy-policy/

• Jersey Post - https://www.jerseypost.com/about-us/privacy-and-website-policy/

• Yodel - https://www.yodel.co.uk/privacy-cookies-policy/

• Collect+ - https://www.collectplus.co.uk/privacy-policy/

• Payment and Credit Agencies (contractual performance) - Think credit card reference agencies and credit card clearing agencies. We use these very reliable, very trustworthy companies to process the orders you place with us or help us in the services we provide to you. We couldn’t do what we do without them but, even so, we only give them the data they need to get the job done.

• Fraud prevention partner – We use a trusted service provider in order to help us prevent online fraud and to assist with 3D-secure services. This service provider may use and process your personal information in accordance with privacy and data protection laws. You can read more about the ways our service provider may use and process your personal information by clicking here:

• Marketing Agencies (legitimate interests) - We also share your name, address, IP addresses, email address and transaction history with data selection analysts, data segmentation and ranking agencies, market research companies and email marketing agencies. It sounds very complicated but these organisations help us to analyse our customer base and to identify potential new customers, to target our marketing in a way that is most relevant for you, and show you the content that is relevant to you (based on your location). In all instances, we provide them with only the data they need to perform their function.

• Google: To help personalise your journey through Boden we use Google, who will process your personal data as one of our advertising partners. Cookies are used to allow for media optimisation and reporting. These are optional for the user and allow us to assess the likelihood of conversion across Google properties or ecosystems. You can manage your cookie setting via the link at the bottom of this Privacy Notice. For further information about how Google use your personal data, please see the following link Google Policies

• Upon sale of business assets (legal obligation) - In the unlikely event that our business assets are sold or purchased by another company, our data records will be sold too as part of our business.

• Research Companies (legitimate interests) - We care what you think so we sometimes ask outside research companies to contact you directly for opinions on our products and services (again, we’ll only give them the data they need to get this done).

• Research Agencies for qualitative research e.g. WhatsApp Groups (consent) – If you participate in qualitative research, such as WhatsApp groups, we sometimes get support in the management and moderation from research agencies (e.g. Kokoro Global). If we are going to be working with a third party research agency for any type of qualitative research project, we will always let you know when you sign up to participate that your data will need to be shared with the agency. Our agencies only ever use your data for the purposes of that project and the relevant privacy policy will always be provided at the time. Kokoro Global, who we work with most commonly, have their privacy information here:

• Customs authorities (legal obligation) - We may have a legal obligation to share your name and address with customs authorities in order to transfer your goods in to the UK.

• Our presents partners (legitimate interests) – Every now and then, we like to surprise our lovely customers with presents and treats. In order to do so, we may share your data with our trusted partners who will send the presents on to you.

• Competition partners (consent) – When you enter a competition which Boden is hosting with another partner, Boden may share your data with the other partner in order to fulfil your prize or so that you can receive marketing from the partner. Boden will only share your data in this way based on your consent. Partners include Cowshed – please see their privacy policy for more information: Cowshed policies

• Email and SMS providers (consent) – if you sign up to receive a discount and our marketing emails or marketing SMS, we may share your data with a company called Attentive who help to administer your discount and the emails / SMS messages that you will receive. For more information about how Attentive use your data, please see their privacy policy: Attentive policy link

• BodenByMe (consent) - When you upload your BodenByMe photos (thanks for these!), we work with a partner called StoryStream who makes sure this runs smoothly on our behalf.

• Product Reviews (consent) – We work with a company called PowerReviews that helps us to publish your product reviews on our website. When you submit your product review through our website, the nickname, age and email address that you enter (along with your review) will be collected by PowerReviews. You can read more about how PowerReviews looks after your personal data by clicking the below links:

https://www.powerreviews.com/privacy-policy/

https://www.powerreviews.com/data-protection/

• Data Cooperatives (legitimate interests) – We may share your name, address and details about what you’ve ordered from us with our data cooperative partners. Our partners are Abacus ("Epsilon") and Experian. These partners manage prospect pools on behalf of UK retailers. Epsilon (registered as Epsilon International UK Ltd) is a company that manages the Abacus Alliance on behalf of UK retailers and charities. The participating retailers are active in the clothing, collectables, food & wine, gardening, gadgets & entertainment, health & beauty, household goods, home interiors and travel categories. Our partners analyse information about what our customers buy in order to help us understand your buying patterns. This helps us plan what we send you, based on what you like to buy. They also help us to ensure that you don’t hear from us if you don’t want to therefore if you’ve told us that you don’t want to receive another catalogue from us, we’ll share your information with them to ensure you’re added to a suppression list. In addition, the partners analyse what sort of products might interest you and pass your name and address to companies whose products are likely to appeal to you. You can opt out of your name and address being passed to other companies at any time by contacting us using any of the methods in the ‘Contact Us’ section of this privacy notice.

Using your data outside the eea and uk

In addition to our UK and EU customer service teams, we have a customer service centre in the US. Sometimes, when we’re really In addition to our UK and EU customer service teams, we have a customer service centre in the US. Sometimes, when we’re really busy, your calls or emails might go transatlantic. Say ‘howdy’ to our US colleagues.

Some of our third party processors may transfer your data outside of the UK and EEA. We ensure that our processors are contractually bound to implement appropriate data security at all times and implement the right safeguards.

Please contact us if you would like more information about how we protect your transferred data.busy, your calls or emails might go transatlantic. Say ‘howdy’ to our US colleagues

Some of our third party processors may transfer your data outside of the UK and EEA. We ensure that our processors are contractually bound to implement appropriate data security at all times and implement the right safeguards

Please contact us if you would like more information about how we protect your transferred data.

Changing your preferences

Please contact us with your request. Don’t forget to include your full name, postal address and email address so that one of our advisors can help you!

How long is your data kept?

We don’t want to get all intense, but as long as you keep shopping with us we like to think we’re ‘in a relationship’. That means we keep a record of the story so far, from your first pair of animal-print boots to that classic wrap dress you wear all the time. This record helps us answer any questions about your order history – or take you on a stroll down memory lane. And we know when we’re not wanted. If you haven’t shopped with us for six years, we’ll come to the sad conclusion that we may have lost you, and delete your data from all our systems (sniff). Or you can ask us at any time ­– via any of the methods listed in our Contact Us section – to erase it. (We will, pronto.)

We might also need to keep your data for important legal or audit purposes, to resolve disputes, and to prevent fraud and abuse. In these situations we may need to hold some of your data after you have closed your account.

Your rights

• You have the right to be informed about how your personal data is being used. This is done, for example, through this privacy notice.

• You have a right to access any personal data we hold about you and we’ll deal with any subject access request within 30 days (we never like to keep you waiting). Please contact our Data Protection Officer (DPO) using the details listed in our Contact Us section, marking your request ‘subject access request’ and giving us your name, address, email address and account number so we can get hold of it in a jiffy.

• You have the right to ask us to stop or pause processing your data, erase your data or amend your data. Please get in touch with us via any of the methods listed in our Contact Us section if you’d like us to do any of these things, and as far as we’re able to (when taking into account our own legal obligations) we’ll make it happen. You can also amend your own personal data by accessing ‘Your Account’ on our website.

• You have the right to stop receiving direct marketing. Just ask us to take you off the list, via any of the methods in our Contact Us section.

• You have the right of portability over your data (i.e. you can ask us to pass the data we hold on you to a third party in machine-readable format). Let us know if you want us to do this using the details in our Contact Us section.

• If you have any complaints, you can contact us (see details below) and we’ll do our utmost to get to the bottom of things. If, after contacting our Data Protection Officer you feel your complaint has not been dealt with satisfactorily, you have the right to contact the supervisory authority. The supervisory authority for data protection in the UK is the Information Commissioner’s Office (ICO) which you can contact on 0303 123 1113 or via their website at ico.org.uk.

Cookies

In case you don’t know (lots of us didn’t)… Cookies are small text files that websites send to your computer, and can be thought of as Internet users’ identification cards. They let the website know when the user has returned, which enables the site to bring up information relevant to that user– name and past orders, for example.

Cookies make the interaction between users and websites faster and easier. Without them, it would be very difficult for a website to allow a visitor to fill up a shopping basket or to remember the user's preferences or registration details for a future visit. The Boden website uses cookies to allow customers to move from one part of the site to another, and to add items to the shopping basket without having to log in repeatedly.

Due to our website set-up, you may be asked to confirm your choices more than once when you visit us. Please make sure that you express your choices when prompted, so that we have your accurate preferences for all areas of our website. Just to reassure you, cookies aren’t computer programs, and can't read other information saved on your hard drive. They can’t be used to disseminate viruses or, for example, get hold of a user's email address. They only contain and transfer to the website as much information as the users themselves have disclosed to that website. Please note that cookies are computer-specific, so if you log on to any site from a different computer, the cookie settings on that computer will apply.

For further information about managing and disabling cookies on your computer see www.allaboutcookies.org/manage-cookies.

When you visit our sites, cookies are either served directly by us, or by our business partners. These are the different kinds of cookies we use:

• Essential cookies: These cookies allow you to use the basic functionality of our website. For example, browsing our products, ordering and paying for items, checking your account information and viewing your order history.

• Performance cookies: These cookies allow us to get to know how you use our website. They’re used to analyse visitor information such as usage and visitor numbers, so they help us to see how effective our advertising is and understand what you like. We also use this information to help improve our website, make our marketing more relevant and improve your experience. The data used for these cookies is aggregated and anonymised, which means that we can’t identify you as an individual. In other words, your personal data is not used for these cookies.

• Functionality cookies: These ones allow us to provide additional functionalities to the website, and will retain some settings information. While they’re not essential for the functionality of our site, they do enable extra features that should make your shopping experience even better.

• Targeting cookies: We also use cookies to track your interest in our products. We may use these to understand what most appeals to you, so we can make our offers as appropriate as possible. Browsing behaviour is also used to create relevant banner advertising, with product recommendations that we believe best relate to the items you viewed on our website. These banners are then served across other websites that you may visit, typically news sites, video sites and blogs. This process is called behavioural advertising and, although the adverts are individually tailored to you, all cookie data is anonymised and stored temporarily. Additionally, all banners of this type feature an ‘i’ icon that provides more information from each advertising network and instructions on how to opt out. We also use the browsing behaviour data to create personal product recommendations on our website, our marketing emails and in our printed catalogue.

Please click the button below to manage your cookie preferences and settings.

Change to this privacy notice

From time to time, we may make changes to this privacy notice in order to make sure that we are providing you with the most up-to-date information. If and when we make changes to this privacy notice, we will summarise the changes in this section. If the changes are significant, we may also chose to email our customers who have provided us with their email address. Any changes to this privacy notice will apply to you and your data immediately.

This privacy notice was updated on:

• 20 January 2023 - to add information about receiving marketing text messages

• 21 October 2022 - to add information about Google

• 22 August 2022 – to add information about SMS messaging and how we use and share information provided in competition entries

• 4 May 2022 – to add information about Yodel (joint controller), links to other Boden privacy notices, and customers making purchases on behalf of other people

• 21 April 2022 – to add information about how Boden uses data to provide clothes to Ukrainian refugee children

• 19 April 2022 – to add information about Forter (joint controller) and influencers, and update information about Power Reviews

• 17 September 2021 - to refresh the format of the privacy notice and add information about sending presents to customers.

• 29 June 2021 – to add information about BodenByMe & Product reviews.

• 11 June 2021 – updated companies that pass us data.

• 12 May 2021 – to add information about our ‘Pass It On’ recycling scheme & updated information about collection and use of IP addresses.

• 18 March 2021 – to add information about where we may obtain data from or share data with as part of our customer insight activities.

• 21 December 2020 – to update information about who we share data with and receive data from, and to add information about the UK’s departure from the EU.

• 13 May 2020 – to reflect the revised timeline for unsubscribing from catalogues from eight weeks to six weeks.

• 6 April 2020 – to include the ‘Data Protection and Coronavirus’ section.


RECRUITMENT AND ONBOARDING PRIVACY NOTICE


Introduction

We are thrilled that you’d like to join our team. As part of our recruitment and onboarding processes, we process personal data about all job applicants. We will always be transparent with you about how we are using your data and we are committed to complying with our data protection obligations.

This privacy notice explains the type of information we process, why we are processing it and how that processing may affect you.

What do we mean by ‘personal data’ and ‘processing’?

• ‘Personal data’ is information relating to you (or from which you may be identified) which is processed by automatic means or which is (or is intended to be) part of a structured manual filing system. It includes not only facts about you, but also intentions and opinions about you. In this privacy notice, we may also refer to this as ‘your information’ or ‘your personal information.

• ‘Processing’ means doing anything with personal data. For example, it includes collecting it, holding it, disclosing it or deleting it.

• Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sexual orientation, sex life, trade union membership and genetic and biometric data are subject to special protection and considered to be ‘special category personal data’.

What information do we collect?

As part of recruitment and onboarding, we may process the following data:

• your name, address and contact details, including email address and telephone number;

• details of your qualifications, skills, experience and employment history; including start and end dates with previous employers

• information about your current remuneration,

• information about your nationality and entitlement to work in the UK;

• information about your driving licence and use of a vehicle

• for regulated roles requiring disclosure barring service checks or AccessNI (Northern Ireland) we will collect information regarding the outcome of those checks and criminal record noted;

• information about medical or health conditions, including whether or not you have a disability for which the organisation needs to make reasonable adjustments

• equal opportunities monitoring information including information about your ethnic origin, sexual orientation and religion or belief.

• date of birth and gender

• details of your bank account and national insurance number

• information about your marital status, next of kin, dependants and emergency contacts

• a copy of your identification document

Your data might be collected through application forms, CVs, obtained from your passport or other identity documents such as your driving licence or qualifications from forms completed by you during the recruitment and onboarding processes; from correspondence with you; or through interviews and meetings with you.

We may collect personal data about you from third parties, such as references supplied by former employers, educational establishments or personal referees and information from criminal records checks permitted by law.

How do we store your data?

Data will be stored in a range of different places, including our HR system (WorkDay) and in other IT systems (including the organisation's email system), and electronic personnel folders.

Why do we process your personal data?

We need to process our personal data in order to enter into an employment contract with you and to meet our regulatory and legislative obligations.

We won’t use your data for any other purpose other than recruitment and onboarding.

What’s Boden’s lawful basis for processing your information?

• Contract – we may need to process your data in order to enter a contract with you.

• Legal obligation – we may need to process your data in order to comply with our legal obligations, for example, checking that you are entitled to work in the UK.

• Legitimate interests – we may need to process your personal data in order to manage the recruitment process, assess and confirm your suitability for employment, decide who we should offer a job to, obtaining occupational health advice (where necessary), and making sure our HR administration is as effective as possible (and to make improvements as required).

• Consent – if your application is unsuccessful, we will ask you if we may keep your personal data on file in case there are future employment opportunities which may interest you. If you do provide your consent, you are free to withdraw this consent at any time.

Where we process special categories of personal data (for example, information about ethnic origin, sexual orientation, religious beliefs, health or medical conditions) or data relating to criminal convictions during recruitment and onboarding, we do this to carry out our obligations in relation to employment or with your explicit consent (according to the Data Protection Act, 2018).

Who do we transfer your data to?

We may share your data with other companies in order to conduct certain activities during the recruitment and onboarding processes, for example to conduct background checks or to contact your referees. The companies that may receive your information during our recruitment and onboarding processes will not be based outside the European Economic Area (EEA) unless your previous employer is from outside the EEA.

How do we keep your information secure?

The security of your data is our priority. We have internal policies, procedures and processes in place to make sure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the performance of their duties. Third parties who process your personal data on our behalf (our ‘data processors’) do so under a written contract and are required to adhere to the same standards that Boden sets for itself.

How long do we keep your information?

If your application is successful and you decide to come and join our team (yay!), your personal data collected during the employment and onboarding process will be transferred to your personnel file and will be retained in line with our employee data retention periods (you’ll be able to review these retention periods when you start your employment with us).

In some cases, your application may be unsuccessful. In these cases, we will hold your information for twelve months after the end of the recruitment process and then your information will be destroyed.

What happens if you don’t provide your personal information?

Sadly, we might not be able to consider your application, fulfil our legal obligations, or offer you a position if you don’t provide your information to us during recruitment and onboarding.

What are your rights?

You have the following rights in relation to your personal data. You can:

• access and obtain a copy of your data on request;

• require the organisation to change incorrect or incomplete data;

• require the organisation to delete or stop processing your data when the data is no longer necessary for the purposes of processing; and

• object to the processing of your data in certain circumstances.

None of our employment decisions are based solely on automated decision making or profiling.

How can you get further information or lodge a complaint?

If you would like to exercise any of your rights, have questions about this privacy notice, please contact our Data Protection Officer (DPO@boden.co.uk).

If you have any complaints, you can contact us (see details below) and we’ll do our utmost to get to the bottom of things. If, after contacting our Data Protection Officer you feel your complaint has not been dealt with satisfactorily, you have the right to contact the supervisory authority. The supervisory authority for data protection in the UK is the Information Commissioner’s Office (ICO) which you can contact on 0303 123 1113 or via their website at ico.org.uk.